MACsec key exchange attribute reflection for transparent provider backbone bridge forwarding over public ethernet provider backbones
The present disclosure is directed to systems and methods for transparent Provider Backbone Bridge forwarding of MACsec key exchanges over public Ethernet provider backbones. The method includes the steps of receiving, at a first PBB device, an Ethernet frame from a first edge router for transmission to a second edge router via a MACsec connection, the Ethernet frame comprising a plurality of fields; performing a lookup of one or more fields of the plurality of fields to determine a match with one or more pre-defined values; determining that the one or more fields of the Ethernet frame match the one or more pre-defined values; rewriting the one or more fields of the Ethernet frame to one or more open values operable to allow the Ethernet frame to be transmitted to a next hop device; and transmitting the Ethernet frame to the next hop device.
1. A system, comprising:
one or more processors;
one or more computer-readable non-transitory storage media comprising instructions that, when executed by the one or more processors, cause one or more components of the system to perform operations comprising:
receiving, at a first provider backbone bridge (PBB) device, an Ethernet frame from a first edge router, the Ethernet frame configured for transmission to a second edge router via a Media Access Control security (MACsec) connection and comprising an Ether-type field;
performing, by the first PBB device, a lookup of the Ether-type field of the Ethernet frame to determine a match with one or more pre-defined values;
determining, by the first PBB device, that the Ether-type field of the Ethernet frame matches the one or more pre-defined values;
rewriting, by the first PBB device, the Ether-type field of the Ethernet frame to an open value, the open value operable to allow the Ethernet frame to be transmitted to a next hop device;
transmitting, by the first PBB device, the rewritten Ethernet frame to the next hop device; and
performing, by the next hop device, a lookup of the Ether-type field of the rewritten Ethernet frame to determine a next action.
2. The system of claim 1 , wherein the first edge router is engaged in a MACsec key exchange with the second edge router.
3. The system of claim 1 , wherein rewriting the Ether-type field further comprises rewriting the Ether-type field to a value corresponding to 0x876F.
4. The system of claim 1 , wherein the Ether-type field comprises a value corresponding to 0x888e.
5. The system of claim 1 , wherein the operation of rewriting the Ether-type field is configured by policy on the first PBB device.
6. The system of claim 1 , wherein the rewritten Ether-type field of the Ethernet frame is operable to be modified to its original value at a second PBB device associated with the second edge router.
7. A method, comprising:
receiving, at a first provider backbone bridge (PBB) device, an Ethernet frame from a first edge router, the Ethernet frame configured for transmission to a second edge router via a Media Access Control security (MACsec) connection and comprising an Ether-type field;
performing, by the first PBB device, a lookup of the Ether-type field of the Ethernet frame to determine a match with one or more pre-defined values;
determining, by the first PBB device, that the Ether-type field of the Ethernet frame matches the one or more pre-defined values;
rewriting, by the first PBB device, the Ether-type field of the Ethernet frame to an open value, the open value operable to allow the Ethernet frame to be transmitted to a next hop device;
transmitting, by the first PBB device, the rewritten Ethernet frame to the next hop device; and
performing, by the next hop device, a lookup of the Ether-type field of the rewritten Ethernet frame to determine a next action.
8. The method of claim 7 , wherein the first edge router is engaged in a MACsec key exchange with the second edge router.
9. The method of claim 7 , wherein rewriting the Ether-type field further comprises rewriting the Ether-type field to a value corresponding to 0x876F.
10. The method of claim 7 , wherein the Ether-type field comprises a value corresponding to 0x888e.
11. The method of claim 7 , wherein the operation of rewriting the Ether-type field is configured by policy on the first PBB device.
12. The method of claim 7 , wherein the rewritten Ether-type field of the Ethernet frame is operable to be modified to its original value at a second PBB device associated with the second edge router.
13. One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause the performance of operations comprising:
receiving, at a first provider backbone bridge (PBB) device, an Ethernet frame from a first edge router, the Ethernet frame configured for transmission to a second edge router via a Media Access Control security (MACsec) connection and comprising an Ether-type field;
performing, by the first PBB device, a lookup of the Ether-type field of the Ethernet frame to determine a match with one or more pre-defined values;
determining, by the first PBB device, that the Ether-type field of the Ethernet frame matches the one or more pre-defined values;
rewriting, by the first PBB device, the Ether-type field of the Ethernet frame to an open value, the open value operable to allow the Ethernet frame to be transmitted to a next hop device;
transmitting, by the first PBB device, the rewritten Ethernet frame to the next hop device; and
performing, by the next hop device, a lookup of the Ether-type field of the rewritten Ethernet frame to determine a next action.
14. The one or more computer-readable non-transitory storage media of claim 13 , wherein the first edge router is engaged in a MACsec key exchange with the second edge router.
15. The one or more computer-readable non-transitory storage media of claim 13 , wherein rewriting the Ether-type field further comprises rewriting the Ether-type field to a value corresponding to 0x876F.
16. The one or more computer-readable non-transitory storage media of claim 13 , wherein the Ether-type field comprises a value corresponding to 0x888e.
17. The one or more computer-readable non-transitory storage media of claim 13 , wherein the operation of rewriting the Ether-type field is configured by policy on the first PBB device.